Split the operator TUI out of the detector's supply chain

[Ray-Rose]

Why

Found auditing the repo as a whole rather than file-by-file — it is invisible from inside any single file.

flyingsquirrel-watch shares no code with the detector. It reads the JSON event log with its own permissive structs (deliberately, so a schema change can't break it). Yet as a [[bin]] in the root package, its dependency tree was welded to the safety-critical one:

Cost	Detail
2 advisory suppressions	ratatui → lru 0.12 put RUSTSEC-2026-0002 and -0253 in the detector's cargo audit. Suppressed as "ratatui's widget cache, NOT the detector" — true, but nothing in the build enforced it
The MSRV	ratatui → instability → darling was the sole reason rust-version was 1.88 rather than 1.85
Shipped weight	A terminal UI in every ARM cross-build, the Docker image, and fuzz/Cargo.lock

The last one is how it surfaced: the NMEA/MAVLink fuzz harness was getting Dependabot PRs for a TUI library (#17, ratatui 0.30). A security tool that decodes wire bytes had no business tracking a dashboard's dependencies.

What

Move it to watch/ as a detached workspace with its own lockfile — same pattern, same reason, as fuzz/.

A workspace member would not work: members share one Cargo.lock, so lru would remain in the detector's audit scope and the whole exercise would be pointless. That's why this is a detached crate.

Result: 34 crates leave the detector (288 → 254). lru, ratatui, crossterm, darling, instability are gone from the detector's and the fuzz harness's lockfiles — so the two lru ignores are deleted from ci.yml rather than argued. They now live in a new watch CI job scoped to the crate that actually pulls them. The boundary is structural instead of asserted.

MSRV: re-derived, not assumed

It stays 1.88. I expected it to drop to 1.85 and checked rather than claiming it — with ratatui gone the binding constraint moved to nmea → serde_with → time 0.3.47. Verified by a reachability walk over cargo metadata --filter-platform x86_64-unknown-linux-gnu excluding dev-deps, because the flat package list includes unlinked entries and gives the wrong answer.

That's a better place for the floor: a core functional dependency rather than an operator dashboard.

Also in this pass

• Open dependency PRs applied together so the tree resolves once instead of five rebase rounds: toml 0.8 → 1.1 and thiserror 1.0 → 2.0 (both major), plus tokio-stream and async-trait. Full suite green on both majors. This supersedes Bump crossterm from 0.28.1 to 0.29.0 #8, Bump tokio-stream from 0.1.18 to 0.1.19 #9, Bump toml from 0.8.23 to 1.1.3+spec-1.1.0 #10, Bump async-trait from 0.1.89 to 0.1.92 #11, Bump crossterm from 0.28.1 to 0.29.0 in /fuzz #14, Bump thiserror from 1.0.69 to 2.0.18 #16, Bump ratatui from 0.29.0 to 0.30.2 in /fuzz #17.
• deploy/Dockerfile: the builder image had been bumped 1.88 → 1.97 while still carrying an MSRV = 1.88, keep this in sync comment — the exact drift risk flagged when that bump was taken. The image tracks a current toolchain on purpose; proving the MSRV is the CI msrv job's duty. Split the two so a base-image bump can't silently invalidate the claim again.
• Deleted docs/sitl_driver.py — a deprecated prototype, superseded by deploy/sitl/sitl_harness.py, guarded to refuse to run, referenced by nothing. Git history keeps it.
• README: documented the dashboard (a shipped binary with no docs at all) and corrected the now-stale MSRV rationale.

Verified

• Detector: cargo fmt --check, clippy --all-targets --all-features -D warnings, 182 lib tests, 35 integration tests across all 14 suites (run individually), 10 proptests.
• watch/: cargo fmt --check, clippy --all-targets -D warnings, 4 tests.
• Confirmed lru/ratatui/crossterm/darling/instability absent from both Cargo.lock and fuzz/Cargo.lock.

Not changed

No detector logic. Zero lines of detection, nav, MAVLink, or hardware-ingest code were touched — this is packaging, dependency scope, and docs.

🤖 Generated with Claude Code